GitLab Fixes Maximum Severity Security Vulnerability

GitLab issued security patches for a CVSS 10.0 flaw that permits unauthenticated attackers to execute arbitrary code.

NationPulse Desk

Oct 22, 2026 · 3:44 PM 2 min read

Key takeaways

GitLab released patches for a CVSS 10.0 vulnerability on October 21.

The bug stems from an integer overflow in the Onigmo regex engine.

Self-managed installations are at risk since no workarounds exist.

A researcher named joaxcar discovered four regex execution flaws in about a month.

Security updates went live on October 21 from GitLab to address a severe vulnerability rated 10.0 on the CVSS scale, which enables malicious actors without authentication to run dangerous code against self-managed GitLab servers.

The vulnerability exists inside Onigmo, a regular expression engine used by Ruby and distributed within GitLab packages. An integer overflow happening during regex compilation causes the problem, meaning a specially designed regular expression grants malicious users complete server control.

Seven distinct versions received patches simultaneously, covering releases from 18.11.13 through 19.5.1. Four of these fixed versions sit outside regular support timeframes, as GitLab restricts such extensive backports strictly to critical vulnerabilities.

This discovery represents the fourth code-execution vulnerability found inside the regex engine over roughly a month. All four security issues were uncovered by an investigator known as joaxcar, who also identified CVE-2026-97229, another CVSS 10.0 bug addressed on October 12. Because exact exploitation requirements remain undisclosed by GitLab, administrators cannot bypass the risk through configuration changes.

Hosted environments on GitLab.com and GitLab Dedicated already use updated software, leaving only self-managed servers vulnerable. Because workarounds do not exist, installing the patch remains the sole defense.

Ten additional security flaws were resolved during this same update cycle. CVE-2026-15723 carries a CVSS score of 8.2 and permits authenticated users to hijack other accounts when servers use both SAML and LDAP auto-linking. Another issue, CVE-2026-112212, has a CVSS score of 7.5 and involves cache poisoning within OAuth and OpenID Connect authentication workflows.

Active exploitation of the bug has not been observed by GitLab, and the issue was absent from the CISA Known Exploited Vulnerabilities list as of October 22. Detection rules were released through the open-source TLDR framework to help administrators scan logs for exploitation attempts.

Questions and answers